Breach Notification Policy

Procedures for identifying, evaluating, and notifying affected parties of PHI breaches.

Home

Organization: Control Alt Growth

System: File Logic

Effective: December 2025

Purpose

To outline procedures for identifying, evaluating, and notifying affected parties of PHI breaches.

Definition of a Breach

Any unauthorized acquisition, access, use, or disclosure of PHI.

Breach Response Procedure

  1. Immediate containment
  2. Investigation (scope, impact, systems involved)
  3. Risk assessment of compromise
  4. Mitigation (patching, access revocation, data remediation)
  5. Documentation
  6. Notification within 60 days when required

Notification Recipients

  • Affected clients
  • HHS OCR (as required)
  • Media if >500 individuals affected